archive/php-src
1
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2025-08-15 21:48:51 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix GH-18212: fseek with SEEK_CUR and negative offset crash on debug

Browse source 
Triggers the assertion as with SEEK_CUR the stream position is set to a
negative value so we force the failure without affecting its position
instead.

close GH-18224
This commit is contained in:
David Carlier 2025-04-01 18:58:31 +01:00
parent a21065e6eb
commit 2e47442a6b
No known key found for this signature in database
GPG key ID: 2FB76A8CE6CD2B41
4 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
NEWS
View file

@ -10,6 +10,8 @@ PHP NEWS
. Fixed bug GH-18145 (php8ts crashes in php_clear_stat_cache()).
(Jakub Zelenka)
. Fixed bug GH-18209 (Use-after-free in extract() with EXTR_REFS). (ilutov)
. Fixed bug GH-18212 (fseek with SEEK_CUR whence value and negative offset
leads to negative stream position). (David Carlier)
10 Apr 2025, PHP 8.3.20

13
ext/standard/tests/file/gh18212.phpt Normal file
View file

@ -0,0 +1,13 @@
--TEST--
GH-18212: fseek with SEEK_CUR and negative offset leads to negative file stream position.
--FILE--
<?php
$fp = fopen('php://input', 'r+');
var_dump(fseek($fp, -1, SEEK_SET));
var_dump(fseek($fp, -32, SEEK_CUR));
fclose($fp);
?>
--EXPECT--
int(-1)
int(-1)

2
ext/standard/tests/file/stream_rfc2397_007.phpt
View file

@ -118,7 +118,7 @@ int(2)
bool(false)
===S:-10,C===
int(-1)
bool(false)
int(2)
bool(false)
===S:3,S===
int(0)

4
main/streams/streams.c
View file

@ -1390,6 +1390,10 @@ PHPAPI int _php_stream_seek(php_stream *stream, zend_off_t offset, int whence)
}
whence = SEEK_SET;
break;
case SEEK_SET:
if (offset < 0) {
return -1;
}
}
ret = stream->ops->seek(stream, offset, whence, &stream->position);